A security company built its case on a simple question: what is this software supposed to do? Its answer is a runtime gate for the code businesses cannot afford to stop.